Digging a bit deeper it looks like a deadlock between Fusion360 and RCPSS happening within:
PushSubscriberEventSource::unsubscribe
or at a deeper level within
CPubINetworkListManager::GetPrivateNetworkListManager
My 30 second guess is that it is hanging waiting to unsubscribe from the private network event source.
Stack text:
0000008c`8fafcb58 00007ffd`82493d9f : 0000008c`8fafd319 0000008c`8fafceb0 0000008c`8fafd2c0 0000008c`8fafceb0 : ntdll!NtAlpcSendWaitReceivePort+0x14
0000008c`8fafcb60 00007ffd`824a8c87 : 00000000`00000000 00007ffd`829d1420 0000008c`8fafcd00 0000008c`8fafd319 : RPCRT4!LRPC_BASE_CCALL::SendReceive+0x12f
0000008c`8fafcc30 00007ffd`824517f0 : 00000000`00000000 0000019c`73426d40 0000008c`8fafd319 00000000`00000000 : RPCRT4!NdrpSendReceive+0x97
0000008c`8fafcc60 00007ffd`8245120f : 00000000`00000000 0000008c`8fafd4b0 00000000`00000000 0000008c`8fafd4b0 : RPCRT4!NdrpClientCall2+0x5d0
0000008c`8fafd280 00007ffd`827b92b1 : 0000798f`b3680ca3 00007ffd`82a1e158 0000019c`73426d40 0000019c`77963d80 : RPCRT4!NdrClientCall2+0x1f
0000008c`8fafd2b0 00007ffd`827b912d : 00000000`00000000 00000000`00000000 0000008c`8fafd4b0 0000019c`77812380 : combase!CoGetCurrentLogicalThreadId+0x58f1
0000008c`8fafd370 00007ffd`827b9981 : 0000019c`779f80e0 0000008c`8fafd580 00000000`00000014 00000000`00000000 : combase!CoGetCurrentLogicalThreadId+0x576d
0000008c`8fafd480 00007ffd`827eb6cf : 0000019c`779f80e0 0000019c`779f80e0 00000000`00000000 0000019c`77804320 : combase!CoGetCurrentLogicalThreadId+0x5fc1
0000008c`8fafd630 00007ffd`827efaf2 : 00000000`00000000 00000000`00000000 0000019c`77812380 0000008c`8fafdab0 : combase!CoMarshalInterface+0x431f
0000008c`8fafd6a0 00007ffd`827fe5a3 : 0000019c`77804320 00007ffd`8280013f 00000000`00000001 0000008c`8fafe768 : combase!CoGetStandardMarshal+0x4e2
0000008c`8fafd6d0 00007ffd`827fdfd0 : 00000000`00000000 00000000`00000000 0000019c`77804320 00000000`00000010 : combase!CoGetTreatAsClass+0x1bd3
0000008c`8fafd710 00007ffd`82863206 : 0000008c`8fafdec8 0000008c`8fafe768 00000000`00000000 0000008c`8fafd930 : combase!CoGetTreatAsClass+0x1600
0000008c`8fafd8d0 00007ffd`827fcf05 : 0000008c`8fafdec8 0000008c`8fafdb60 0000008c`8fafd930 00000000`00000000 : combase!CoGetModuleArchitecture+0x7f6
0000008c`8fafd900 00007ffd`82800610 : 0000008c`8fafdec8 ffffff73`70502370 00000000`00000000 00000000`80004005 : combase!CoGetTreatAsClass+0x535
0000008c`8fafdbb0 00007ffd`8280b7ba : 00000000`00000000 0000008c`8fafe6f0 00000000`00000001 00000000`00000000 : combase!CoGetTreatAsClass+0x3c40
0000008c`8fafdc40 00007ffd`8280a289 : 0000008c`8fafed78 0000019c`7799ace0 0000019c`7799ace0 00007ffd`8413047c : combase!CoCreateInstance+0x17fa
0000008c`8fafeb10 00007ffd`8280a0cc : 00007ffd`84136940 00000001`00000000 0000008c`00000048 00007ffd`81cacb17 : combase!CoCreateInstance+0x2c9
0000008c`8fafec70 00007ffd`7cdd6cc1 : 0000019c`77816ca0 0000008c`8fafee90 0000008c`8fafeda9 00007ffd`00000004 : combase!CoCreateInstance+0x10c
0000008c`8fafed10 00007ffd`7cdd62b6 : 00000000`00000000 0000019c`779f37b0 0000019c`77816ca0 00000000`00000001 : netprofm!CPubINetworkListManager::GetPrivateNetworkListManager+0x1f1
0000008c`8fafee10 00007ffd`7cdd5825 : 00000000`00000000 0000019c`77816ca0 00000000`00000000 00000000`00000001 : netprofm!CPubINetworkListManager::FinalRelease+0xc6
0000008c`8fafee90 00007ffd`7cdd799b : 00000000`00000000 00000000`00000000 00000000`00000001 00000000`00000000 : netprofm!ATL::CComObject<CPubINetworkListManager>::`scalar deleting destructor'+0x85
0000008c`8fafeec0 00007ffd`0f6a8a92 : 00007ffd`0faefaa8 0000008c`8faff930 00000000`00000000 00000000`00000001 : netprofm!ATL::CComObject<CPubINetworkListManager>::Release+0x4b
0000008c`8fafeef0 00007ffd`0f6a8d7f : 0000019c`77816d20 00000000`00000001 00007ffd`56da0060 00000000`00000001 : NsBase10!Ns::OS::NetworkMonitor::_get+0x122
0000008c`8fafef40 00007ffd`0f58e65e : 00007ffd`56da0060 00000000`0000000a 00000000`00000000 00000000`00000000 : NsBase10!Ns::OS::NetworkMonitor::get+0xdf
0000008c`8fafefa0 00007ffd`56d56ff0 : 00007ffd`56da0100 00000000`0000000a 00000000`00000000 00007ffd`56da0100 : NsBase10!Ns::CloudStatusManager::subscribe+0xe
0000008c`8fafefd0 00007ffd`56d51160 : 00007ffd`56d85e00 00007ffd`56d85e08 00000000`0000000a bc000400`00000000 : NsPushNotifications10!Ns::PushNotificationManager::PushNotificationManager+0xf0
0000008c`8faff070 00007ffd`8184de83 : 00000000`00000007 00000000`00000000 0000008c`8faff930 00007ffd`5976885f : NsPushNotifications10+0x1160
0000008c`8faff0a0 00007ffd`56d80e92 : 00000000`00000000 0000008c`8faff430 0000008c`8faff930 00007ffd`84127b23 : ucrtbase!initterm+0x43
0000008c`8faff0d0 00007ffd`56d81008 : 00000000`00000001 0000008c`8faff930 00000000`00000000 00000000`00000001 : NsPushNotifications10!Ns::PushSubscriberEventSource::unsubscribe+0x1d8c2
0000008c`8faff100 00007ffd`84127bad : 00007ffd`56d50000 00000000`00000001 0000008c`8faff930 00000000`7ffe0385 : NsPushNotifications10!Ns::PushSubscriberEventSource::unsubscribe+0x1da38
0000008c`8faff160 00007ffd`84153493 : 0000019c`733a5630 00007ffd`56d50000 00007ffd`00000001 00007ffd`56d804a0 : ntdll!LdrpCallInitRoutine+0x61
0000008c`8faff1d0 00007ffd`84153226 : 0000019c`733b2670 0000019c`733b2600 0000008c`8faff401 0000019c`00000001 : ntdll!LdrpInitializeNode+0x1d3
0000008c`8faff320 00007ffd`841532ac : 0000019c`73396000 0000019c`733962e0 0000008c`8faff430 0000019c`733b8610 : ntdll!LdrpInitializeGraphRecurse+0x42
0000008c`8faff360 00007ffd`841532ac : 0000008c`8f890000 0000019c`73393ec0 0000008c`8faff430 0000019c`733a2a70 : ntdll!LdrpInitializeGraphRecurse+0xc8
0000008c`8faff3a0 00007ffd`841c2d06 : 00000000`00000000 00000000`00000010 00000000`00000000 00007ffd`842206e0 : ntdll!LdrpInitializeGraphRecurse+0xc8
0000008c`8faff3e0 00007ffd`841b12f1 : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000001 : ntdll!LdrpInitializeProcess+0x1fd6
0000008c`8faff810 00007ffd`841645b3 : 00000000`00000000 00007ffd`840f0000 00000000`00000000 0000008c`8f891000 : ntdll!_LdrpInitialize+0x4cd25
0000008c`8faff8b0 00007ffd`8416455e : 0000008c`8faff930 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!LdrpInitialize+0x3b
0000008c`8faff8e0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!LdrInitializeThunk+0xe
Symbol info on hang:
SYMBOL_NAME: NsPushNotifications10!Ns::PushSubscriberEventSource::unsubscribe+1da38
MODULE_NAME: NsPushNotifications10IMAGE_NAME: NsPushNotifications10.dll
FAILURE_BUCKET_ID: APPLICATION_HANG_HungIn_LoaderLock_cfffffff_NsPushNotifications10.dll!Ns::PushSubscriberEventSource::unsubscribe
OS_VERSION: 10.0.19035.1
Dropping from user mode to kernel give the following ALPC wait info: (Note process and thread is different to above, callstacks will not align)
THREAD ffffe288da5c9080 Cid 10ac.11bc Teb: 0000003991573000 Win32Thread: ffffe288e1b36c30 WAIT: (WrLpcReply) UserMode Non-Alertable
ffffe288da5c9508 Semaphore Limit 0x1
Waiting for reply to ALPC Message ffffb20de6a85c60 : queued at port ffffe288cb341aa0 : owned by process ffffe288cb33c0c0
Not impersonating
DeviceMap ffffb20dca2c2d50
Owning Process ffffe288cf708300 Image: Fusion360.exe
With ALPC message being:
Message ffffb20de6a85c60
MessageID : 0x2F90 (12176)
CallbackID : 0x2FA90F (3123471)
SequenceNumber : 0x00000006 (6)
Type : LPC_REQUEST
DataLength : 0x0192 (402)
TotalLength : 0x01BA (442)
Canceled : No
Release : No
ReplyWaitReply : No
Continuation : Yes
OwnerPort : ffffe288daee7ac0 [ALPC_CLIENT_COMMUNICATION_PORT]
WaitingThread : ffffe288da5c9080
QueueType : ALPC_MSGQUEUE_PENDING
QueuePort : ffffe288cb341aa0 [ALPC_CONNECTION_PORT]
QueuePortOwnerProcess : ffffe288cb33c0c0 (svchost.exe)
ServerThread : ffffe288ce460080
QuotaCharged : No
CancelQueuePort : 0000000000000000
CancelSequencePort : 0000000000000000
CancelSequenceNumber : 0x00000000 (0)
ClientContext : 0000020cd3951d40
ServerContext : 0000000000000000
PortContext : 0000013927204de0
CancelPortContext : 0000000000000000
SecurityData : 0000000000000000
View : 0000000000000000
HandleData : 0000000000000000
Dropping into the port (each way) we can in fact see the threads waiting for IO completion, alongside a single message in the pending queue from the port owned by svchost.exe (in this case RPCSS):
0: kd> !alpc /p ffffe288daee7ac0
Port ffffe288daee7ac0
Type : ALPC_CLIENT_COMMUNICATION_PORT
CommunicationInfo : ffffb20ddb7be560
ConnectionPort : ffffe288cb341aa0 (epmapper)
ClientCommunicationPort : ffffe288daee7ac0
ServerCommunicationPort : ffffe288daee7d20
OwnerProcess : ffffe288cf708300 (Fusion360.exe)
SequenceNo : 0x00000006 (6)
CompletionPort : 0000000000000000
CompletionList : 0000000000000000
ConnectionPending : No
ConnectionRefused : No
Disconnected : No
Closed : No
FlushOnClose : Yes
ReturnExtendedInfo : No
Waitable : No
Security : Dynamic
Wow64CompletionList : No
---
Main queue is empty.
Direct message queue is empty.
Large message queue is empty.
Pending queue is empty.
Canceled queue is empty.
0: kd> !alpc /p ffffe288cb341aa0
Port ffffe288cb341aa0
Type : ALPC_CONNECTION_PORT
CommunicationInfo : ffffb20dc7c9b090
ConnectionPort : ffffe288cb341aa0 (epmapper)
ClientCommunicationPort : 0000000000000000
ServerCommunicationPort : 0000000000000000
OwnerProcess : ffffe288cb33c0c0 (svchost.exe)
SequenceNo : 0x0000031D (797)
CompletionPort : ffffe288cb2df840
CompletionList : 0000000000000000
ConnectionPending : No
ConnectionRefused : No
Disconnected : No
Closed : No
FlushOnClose : Yes
ReturnExtendedInfo : No
Waitable : No
Security : Static
Wow64CompletionList : No
--
10 thread(s) are registered with port IO completion object:
THREAD ffffe288cb3472c0 Cid 043c.0460 Teb: 000000362e25e000 Win32Thread: 0000000000000000 WAIT
THREAD ffffe288cb663080 Cid 043c.07b4 Teb: 000000362e26e000 Win32Thread: 0000000000000000 WAIT
THREAD ffffe288cbef5080 Cid 043c.2aec Teb: 000000362e27a000 Win32Thread: 0000000000000000 WAIT
THREAD ffffe288cbe99080 Cid 043c.2af0 Teb: 000000362e27c000 Win32Thread: 0000000000000000 WAIT
THREAD ffffe288cbef25c0 Cid 043c.2af8 Teb: 000000362e280000 Win32Thread: 0000000000000000 WAIT
THREAD ffffe288d89de080 Cid 043c.6838 Teb: 000000362e2a2000 Win32Thread: ffffe288e1461b20 WAIT
THREAD ffffe288ce460080 Cid 043c.5aac Teb: 000000362e2ac000 Win32Thread: 0000000000000000 WAIT
THREAD ffffe288cf8ee040 Cid 043c.63ec Teb: 000000362e2b4000 Win32Thread: 0000000000000000 WAIT
THREAD ffffe288cea98080 Cid 043c.5084 Teb: 000000362e2ba000 Win32Thread: 0000000000000000 WAIT
THREAD ffffe288ce9e8080 Cid 043c.0d08 Teb: 000000362e2bc000 Win32Thread: 0000000000000000 WAIT
Main queue is empty.
Direct message queue is empty.
Large message queue is empty.
Pending queue has 1 message(s)
ffffb20de6a85c60 00002f90 00000000000010ac:00000000000011bc ffffe288da5c9080 ffffe288ce460080 LPC_REQUEST
Canceled queue is empty.
Digging into the server thread (within svchost.exe) for the fusion message, we actually see svchost.exe is waiting for a reply to an ALPC message! This is our lock, but why is this happening?! Taking a snip of both threads:
0: kd> !thread ffffe288ce460080
THREAD ffffe288ce460080 Cid 043c.5aac Teb: 000000362e2ac000 Win32Thread: 0000000000000000 WAIT: (WrLpcReply) UserMode Non-Alertable
ffffe288ce460508 Semaphore Limit 0x1
Waiting for reply to ALPC Message ffffb20dcb878c60 : queued at port ffffe288d77e09f0 : owned by process ffffe288cf708300
...
Owning Process ffffe288cb33c0c0 Image: svchost.exe
...
0: kd> !thread ffffe288da5c9080
THREAD ffffe288da5c9080 Cid 10ac.11bc Teb: 0000003991573000 Win32Thread: ffffe288e1b36c30 WAIT: (WrLpcReply) UserMode Non-Alertable
ffffe288da5c9508 Semaphore Limit 0x1
Waiting for reply to ALPC Message ffffb20de6a85c60 : queued at port ffffe288cb341aa0 : owned by process ffffe288cb33c0c0
...
Owning Process ffffe288cf708300 Image: Fusion360.exe
...
Digging into these 2 messages (with 1 being the same as above):
0: kd> !alpc /m ffffb20de6a85c60
Message ffffb20de6a85c60
MessageID : 0x2F90 (12176)
CallbackID : 0x2FA90F (3123471)
SequenceNumber : 0x00000006 (6)
Type : LPC_REQUEST
DataLength : 0x0192 (402)
TotalLength : 0x01BA (442)
Canceled : No
Release : No
ReplyWaitReply : No
Continuation : Yes
OwnerPort : ffffe288daee7ac0 [ALPC_CLIENT_COMMUNICATION_PORT]
WaitingThread : ffffe288da5c9080
QueueType : ALPC_MSGQUEUE_PENDING
QueuePort : ffffe288cb341aa0 [ALPC_CONNECTION_PORT]
QueuePortOwnerProcess : ffffe288cb33c0c0 (svchost.exe)
ServerThread : ffffe288ce460080
0: kd> !alpc /m ffffb20dcb878c60
Message ffffb20dcb878c60
MessageID : 0x4038 (16440)
CallbackID : 0x2FA911 (3123473)
SequenceNumber : 0x00000001 (1)
Type : LPC_CONNECTION_REQUEST
DataLength : 0x0000 (0)
TotalLength : 0x0028 (40)
Canceled : No
Release : No
ReplyWaitReply : No
Continuation : Yes
OwnerPort : ffffe288d8dc7ab0 [ALPC_CLIENT_COMMUNICATION_PORT]
WaitingThread : ffffe288ce460080
QueueType : ALPC_MSGQUEUE_MAIN
QueuePort : ffffe288d77e09f0 [ALPC_CONNECTION_PORT]
QueuePortOwnerProcess : ffffe288cf708300 (Fusion360.exe)
ServerThread : 0000000000000000
It appears as if we are waiting on an LPC_CONNECTION_REQUEST that isn't picked up (still sitting within ALPC_MSGQUEUE_MAIN), but are also waiting on LPC_REQUEST which has been processed (sitting within ALPC_MSGQUEUE_PENDING)!
The biggest pointer though is the ServerThread on message ffffb20dcb878c60 being '0000000000000000', meaning no thread is responsible for servicing the request!
Digging into the port:
0: kd> !alpc /p ffffe288d77e09f0
Port ffffe288d77e09f0
Type : ALPC_CONNECTION_PORT
CommunicationInfo : ffffb20ddb7be290
ConnectionPort : ffffe288d77e09f0 (OLE5799777E502DA20BE7BAC7C73517)
ClientCommunicationPort : 0000000000000000
ServerCommunicationPort : 0000000000000000
OwnerProcess : ffffe288cf708300 (Fusion360.exe)
SequenceNo : 0x00000001 (1)
CompletionPort : ffffe288d1fa2e40
CompletionList : 0000000000000000
ConnectionPending : No
ConnectionRefused : No
Disconnected : No
Closed : No
FlushOnClose : Yes
ReturnExtendedInfo : No
Waitable : No
Security : Static
Wow64CompletionList : No
Main queue has 1 message(s)
ffffb20dcb878c60 00004038 000000000000043c:0000000000005aac ffffe288ce460080 0000000000000000 LPC_CONNECTION_REQUEST
The concerning thing is we have no threads listed here with port IO completion! There is nothing hooked up to actually process this message! Is this a missing DCOM/OLE component?
Hopefully this is of some help, I'll keep digging around to see why this condition is happening.